S2E Evidence — Raw Command Log

Evidence collection only. No edits, no commit, no execution against production. Date 2026-05-19. Repo /Users/nmhuyen/iu-cutter-build/repo/iu-cutter.

[1] Repo state (S2 files present)

$ git branch --show-current
feature/constitution-snapshot-mark-dryrun
$ git rev-parse HEAD
afb7bfcc9b7bbb953bb00159479c9611e6ac4bd1
$ git status --short
?? cutter_agent/cutplan.py
?? tests/test_cutplan_snapshot.py
$ git diff --stat
(empty — zero tracked-file modifications)
$ git ls-files --others --exclude-standard
cutter_agent/cutplan.py
tests/test_cutplan_snapshot.py

[2] File digests (sha256)

548eabc5530260555ff448ce6f3acded9728fe51c4ae61de658e9a97c4d828f1  cutter_agent/cutplan.py
06e871e73496089f5a88f072fb0a1e4f5d4ac720e1cb73bd737bc12d699a578a  tests/test_cutplan_snapshot.py

[3] Targeted S2 suite

$ env -u PG_DSN -u DATABASE_URL -u DIRECTUS_URL -u PGPASSWORD -u PGHOST -u PGUSER \
    python3 -m unittest tests.test_cutplan_snapshot
exit_code = 0
Ran 15 tests in 0.020s
OK

[4] Py compile

$ python3 -m py_compile cutter_agent/cutplan.py tests/test_cutplan_snapshot.py
py_compile: OK (exit 0)

[5] Full unittest discover — S2 files PRESENT

$ env -u PG_DSN -u DATABASE_URL -u DIRECTUS_URL -u PGPASSWORD -u PGHOST -u PGUSER \
    python3 -m unittest discover -s tests
exit_code = 1
Ran 128 tests in 0.030s
FAILED (failures=1)

FAIL: test_source_has_no_hardcoded_dsn_or_secret
  (test_security_boundaries.TestNoSecretPrinted.test_source_has_no_hardcoded_dsn_or_secret)
  File ".../tests/test_security_boundaries.py", line 118,
    in test_source_has_no_hardcoded_dsn_or_secret
  AssertionError: 'PGPASSWORD' unexpectedly found in <source of>
    .../cutter_agent/cutplan.py
  (rglob reached cutplan.py first; the assertion is the libpq-password env-var
   name token appearing in the DB-env refusal guard tuple)

[6] Baseline check — S2 files REMOVED (pure afb7bfc)

$ SC=$(mktemp -d /tmp/s2e-baseline-hold.XXXXXX)
$ mv cutter_agent/cutplan.py            $SC/cutplan.py
$ mv tests/test_cutplan_snapshot.py     $SC/test_cutplan_snapshot.py

$ git status --short      # baseline, S2 removed
(empty — clean tree, no tracked changes)

$ env -u PG_DSN -u DATABASE_URL -u DIRECTUS_URL -u PGPASSWORD -u PGHOST -u PGUSER \
    python3 -m unittest discover -s tests
exit_code = 1
Ran 113 tests in 0.011s
FAILED (failures=1)

FAIL: test_source_has_no_hardcoded_dsn_or_secret
  (test_security_boundaries.TestNoSecretPrinted.test_source_has_no_hardcoded_dsn_or_secret)
  File ".../tests/test_security_boundaries.py", line 118
  AssertionError: 'PGPASSWORD' unexpectedly found in <source of>
    .../cutter_agent/dryrun.py        <-- offending file at baseline = the
                                          RATIFIED MARK entrypoint dryrun.py

$ mv $SC/cutplan.py            cutter_agent/cutplan.py     # restore exactly
$ mv $SC/test_cutplan_snapshot.py tests/test_cutplan_snapshot.py
$ git status --short
?? cutter_agent/cutplan.py
?? tests/test_cutplan_snapshot.py
$ git rev-parse HEAD
afb7bfcc9b7bbb953bb00159479c9611e6ac4bd1

# [6d] re-sha proves byte-exact restoration
548eabc5530260555ff448ce6f3acded9728fe51c4ae61de658e9a97c4d828f1  cutter_agent/cutplan.py
06e871e73496089f5a88f072fb0a1e4f5d4ac720e1cb73bd737bc12d699a578a  tests/test_cutplan_snapshot.py
(identical to [2] — restoration confirmed)

Key invariants observed

test_count_delta: 128 (S2 present) - 113 (baseline) = 15 == exactly the cutplan suite
failure_count: 1 in BOTH configurations
failing_test: identical — test_security_boundaries.TestNoSecretPrinted
              .test_source_has_no_hardcoded_dsn_or_secret @ test_security_boundaries.py:118
assertion: identical — assertNotIn('PGPASSWORD', <module source>)
offending_file: dryrun.py at baseline (ratified, committed afb7bfc) ;
                cutplan.py when present (same guard pattern, rglob order)
HEAD: afb7bfcc9b7bbb953bb00159479c9611e6ac4bd1 throughout (never changed)
tracked_modifications: none (git diff --stat empty) ; untracked: exactly 2
restoration: byte-exact (sha256 unchanged)

Nothing edited, committed, executed against production, or self-advanced.